general About recent Trade Lock

Some of you may already know this, but I thought it would be beneficial to most if this was brought to light.
(These are just my opinion)

Cygames claim the recent Trade-Lock is an anti-measure against "hacking" / "hacked" accounts, and they portray to the public as if they are heavily engaged in a battle against "hackers".

Well the reality is "hacked" account users were never compensated (as in most other online games). So what does this tell us about Cygames? It shows us they believe the users (who claimed to be hacked) were at fault and no compensation should be deemed. Why? Because the users were in fact not "hacked", but they were simply victims of their own stupidity (will be explained later).

Most gamers are quick to jump on the word "hack" without really understanding what really constitutes of hacking. Hacking is a term used when someone force breaches into a network. Brute-force, packet editing, exploits, and client side data modification are all not forms of hacking. Then what is? Well the answer is one, and that is an user breaking into Cygames' (ROB) database.

So why do I claim the recent incidents are not related to hack? Simply because an user who has access to Cygames' database would not waste their time stealing cards from other users' account. Remember, having access to the database means they have the capability to create cards, modify stats / levels at their fingertip.

So why are people getting their accounts stolen?

Lots of people circulated potential of Brute-force. What they don't know is brute-force isn't a kiddy software where one can google, install, click RUN and wait until a password is breached. Brute-force requires much more knowledge than that, and you need to understand the basis of network security in order to even attempt brute-forcing. Add to that the fact it is almost impossible to find a working brute-force software on the internet without actually catching a few trojans and keyloggers on your computer. Furthermore, brute-force would trigger a red alarm on Cygames' network defense within a day. Taking all this into consideration, is brute-force in play? Possibly, but highly unlikely.
(Remember when Cygames posted a notice stating users should enforce a stronger password? You will understand why below)

The real reason behind stolen accounts is actually quite simple. Users who used the same password when they registered to online trade forums such as rage-of-bahamut are most likely the victims. What you have to remember is admins, and on some forums, moderators, have the capability of reading your registered password, and once they have your IGN as well, your account is simply an open buffet. This is why the golden rule is to never use the same password for anything. (Cygames asking you to enforce a stronger password simply means change your password, which leads to your password becoming a different password than (Cygames assuming you have already registered onto some trade forums) the password you have used to register onto 3rd party Rage of Bahamut websites, IF you had used the same password)

Then again, you also have naive users who will fall to phishing sites and "card generator.exe" software which is nothing more than a backdoor trojan / keylogger.

Now then, why is Cygames putting a trade-lock? Well the answer has been provided to us since 2-3 weeks ago. They have always been heavily engaged against massive accounts creation which leads to endless free LCP packs. They reduced from 3, to 2, and then to 1 attainable LCP after the first boss just recently. They have also commenced on breaking down BlueStack, which is the popular Android emulator that allowed users to create endless accounts. What they are seeking is a solution to lessen this form of LCP abuse, while not completely taking it away (remember, it is also beneficial for Cygames that these LCP abusers do circulate hard-to-attain cards so other users have access therefore keeps an interest in the game). Their problem is the fine line of balance that benefits them has been completely run-over, and a massive percentage of Rage users have had easy access to this form of LCP abuse. It seems like they have started taking a HUGE hit on their income, and this balance needs to be restored ASAP.

It will be really interesting to see as to what kind of solution Cygames presents to the users

Well I never liked rage of bahamuts system with integrating twitter directly to any specific account. We all know twitter uses OAuth authentication which is heavily criticized. And who knows what kind of authentication protocol Mobage is using.

Hm.. whatever solution Mobage may have, may it be a pin code for trading any individual card, limiting the max amount of trades and gifts per day or setting in a timer of X amount of time before the trade actually go off, I still believe that Cygames and Mobage really *bleep*ed this one up, hard.

quote tinkis

Well I never liked rage of bahamuts system with integrating twitter directly to any specific account. We all know twitter uses OAuth authentication which is heavily criticized. And who knows what kind of authentication protocol Mobage is using.

Hm.. whatever solution Mobage may have, may it be a pin code for trading any individual card, limiting the max amount of trades and gifts per day or setting in a timer of X amount of time before the trade actually go off, I still believe that Cygames and Mobage really *bleep*ed this one up, hard.

What is fishy about this is the fact that they have limited trading and gifting. Even if they do limit trades to X amount per day, or add a delay timer in trade transactions, it will not actually rectify the root of the problem (which is account stealing).

As you have stated, a pin code for each trade transaction may be the best anti-defense as it adds another filter, yet still does not solve the issue of a 3rd party having access to the account. Not to mention the added feature will be highly unpopular with the users who will find it taxing to input their PIN code for every trade and GIFT.

Unless, as you have mentioned, they release a statement saying they will re-script the whole authentication process, I just don't see this linked to the recent "account hackings".

Our guest is right. My order leader was hacked and got everything back. He is also suing the company ATM also

The thing with this game is that if users wouldn't be creating mass lvl 10 accounts and using the referral code for their own benefit this game would be boring as hell. Why? Because it is very hard to amass the amount of HP or CW needed to trade. There is too few features in the game that gives you reasonable amounts of the currency in the game. And since you get no LCP tickets other than the few in the beginning (which btw have a stupid low rate of actually giving you a good card, especially when you can draw a bloody high normal, that's just stupid), or if you participate in the few HW or other events (which also requires you to use tons of HP/CW, which you wouldn't have in the first place if you didn't create lots of accounts). So Mobage/Cygames force you to either shell out stupid amounts of real cash to buy the LCP (that again gives you HN or rares most of the time), and that isn't viable. Not many people will buy that much stuff in game.

So what should they do? They should either give lots and lots more HP/CW through bosses, other features etc so give people a chance to actually buy some damn cards. Also they should give lots more LCP tickets so that you can have a reasonable chance to get cards to trade. Bah...

quote teadaze

And also, in the beginning when I got the game I bought Mobage Coins worth about $150 that gave me *bleep* all worth of cards. That's not very cool either. So what does that make me do? Either quit playing or starting to find other ways of getting cards and HP which is creating mass lvl 10 accounts.

Cygames have shot them self in the foot.

I think one of the true major reasons that so many have taken to attempting a hack on RoB is very closely related to the point in your opening sentence. When I was first playing the game, I used to spend almost $200 a month on Booster Boxes, which I was unaware of the infinitesimal probabilities of pulling something worthwhile out of actually was. People spend their money on this game, they see the advertising and the trumpet announcements for new HR and SR and SSR Powercards and the max stats they read about and they convert let's say $100 into Mobacoins. They buy the booster boxes, and it's almost like the Powerball....there are a couple of winners...a WHOLE LOT of losers...and some in the middle ground who'll get a HR and three Rs in their box. The creators are gaming themselves in my opinion...they are not making the cash because people have wised up to the entire improbability of pulling the "Golden Ticket" as it were out of the Booster Boxes or Legend Card Packs. If they would like to generate more revenue, they might ought to start by increasing this probability of drawing something bloody useful out of the packs that cost money to get.

Good two cents above.

But imo, Mobage/Cygames did it wrong from the beginning when they've made it so impossible to get better cards. Did they think that all users would spend a lot of money each month to be able to get the better cards? I mean think about how much money you'd have to spend to be able to pick a SR or SSR and UP from a LCD? I've created perhaps 50 accounts in total and once I got a SR card. That's a lot of dough! And how else should one get more HP to be able to compete in HW or use to trade? 1HP/CW are for example 20 gems. If I battle for 1 week without using any HP I get 10 gems because you simply cannot rank higher. So in 2 weeks i get 2HP or 2CW. What the *bleep* am I supposed to do with that? Oh, they thought we use Rupies to trade for better cards? Hmm? That's also stupid since the amount it costs to evolve etc is high as it is. And getting Rupies ain't easy either. So nothing with their way of giving out HP/CW or Cards hold up. And even if no one could create more accounts and someone picks a SR, SSR or Legend card from the few LCP you get on one account, do they seriously think it would bring down prices to get it? One SR would cost like 2000HP instead since it would be so rare with HP.

Correct me if I'm wrong, but this might be the first online game that actually has prohibited trading completely. Add to this the fact Rage of Bahamut is a TCG, blocking the trade system is unheard of.

They are dragging this along quite well, and the recent "3 Million Users Event" is just a sign that they are absolutely in no-rush to restore the trading system. Cygames is mocking the users by throwing a mini "get-free-items-event" to distract our mind from their whole anti-hack hoax.

There have been rumors that Cygames is implementing a script which will strictly enforce one account login per device, which in return will reduce the potential of "hacked" accounts. Unless you're a bit slow, this just simply means they are working against multiple account creations.

As I have stated before, Cygames knew about multiple account creations since long ago. They did not care because it was beneficial to them to have few users circulate hard to obtain cards to the general public for a relatively cheap cost; they were completely caught off-guard when the method became viral, and now it is impacting their pocket.


What Rushuna suggested could very well work in the long run. Having a progressive RNG that resets after a SR/SSR counter is a good way to gain the LCP buyers trust, while driving the cards value lower over time. This will then de-motivate a lot of users to follow the mass account creation method since the dollar amount won't be as appealing, and the cards would be accessible more easily through the market.


And to answer the two users who stated they compensated "hacked" users, everyone I have spoken to did not receive even a single personal holy powder. From what I can tell, if they did, then it is probably because they have spent a large amount of money into the accounts, and Cygames / Mobage was simply retaining a valuable customer, as they know the amount re-imbursed would easily be surpassed over time with the money they generate from those users.